What's new in version 7.2 of Belkasoft Evidence Center

What's New in Version 7.2

In version 7.2 of Belkasoft Evidence Center 2015 we added a lot of new mobile applications for modern smartphones such as iPhone and Android. JTAG analysis for Windows Phone 8.1 is now available, in addition to previously available analysis of mobile device backups, UFED physical and logical images and binary chip-off dumps.

Besides, Evidence Center v.7.2 comes with a pack of reporting, performance and usability improvements.

Finally, Scripting module is now FREE!


Upgrading to version 7.2 is free of charge to all customers with non-expired Extended Software Maintenance and Support contracts. File System and RAM Process Explorer modules can be purchased separately.

Customers without the contract can purchase it from the Customer Portal. Affordable User Refresher Course is available for those who would like to catch up all recent improvements.

New features in v.7.2 of Belkasoft Evidence Center

Mobile devices

  • Android:
    • New Android applications supported: FireChat, Tango, MeetMe, Im+, Whisper, QIWI wallet, Voxer, Google+, Touch, textPlus, MeowChat, Grindr, ooVoo, Hangouts, CommFort, Tinder, SinaWeibo, Vipole, AIM, Evernote, Growlr, BBM, FireChat, Tango, Foursquare.
    • Google Maps analysis for Android improved.
    • Telegram analyzer analysis improved.
  • iOS (iPhone, iPad):
    • New iOS applications supported: FireChat , Tango, MeetMe, Im+, ChatOn, ooVoo, Kakao Talk, Viber, Line, PalTalk, Touch, Voicemail, Grindr, Brosix.
  • Windows Phone 8/81:
    • JTAG analysis supported.
    • Particularly, pagefile is automatically analyzed. (Belkasoft became first to support proper Windows Phone pagefile forensic analysis)
With the latest additions, a number of supported mobile artifacts exceeds 100!


  • Analyzing SQLite unallocated space from index pages supported.

File System

  • Data source (logical disk, hiberfil, pagefile etc) is now shown in HexViewer when selected in the File System window. This particularly allows you to run custom carving right inside Hex Viewer for the whole dump or image!


  • XLSX report redesigned and simplified.
  • A possibility to create a report from SQLite Viewer was added.
  • Search Results report improved.
  • You can now create a report from built-in Google Maps window. Apart from coordinates, altitude and direction, current map view is included to a report as a picture.

User interface

  • License screen now allows to browse for a license. You do not have to unpack the license to Program Files anymore.
  • Case root folder added to the "New case" dialog. You can now specify one base folder to store all cases. Case name is added to the root folder path to store particular case.
  • User interface performance improved for navigation inside Case Explorer when analysis is in progress.
  • "Add another data source" button to Add Data Source screen. Now you can add all devices and images to investigate at once.


  • Predefined searches performance improved.
  • Field name display is improved in Search Results.
  • Pressing Ctrl-B now adds selected items to a last created (or new) bookmark.
  • Direction for QIP carved data is now determined.

Issues fixed in v.7.2 of Belkasoft Evidence Center

Mobile devices

  • Better search for WhatsApp encryption key implemented.
  • Mail.RU extraction improved.
  • Date extraction for Android Tinder app fixed.

File System

  • Single file in File list problem with missing icon and not showing in Hex Viewer fixed.
  • Fixed "Recursive copy of files and folders" from File System window.


  • Extraction of cookies and cache is fixed for Opera 6.
  • Update of Firefox cache2 analysis.

Instant Messengers

  • Artifacts are not extracted for ICQ and Facebook profiles in Pidgin messenger fixed.


  • Failure to create a report for a huge SQLite database fixed.
  • Failure to create XSLX report for Timeline fixed.

System files

  • Windows event log analysis improved.


  • Problem of registry files search fixed.

User interface

  • Mess between different multiple file profiles (carved and files based) eliminated.
  • Scrolling in built-in PDF preview fixed.
  • Duplication of Case Explorer window nodes for $MFT and $LogFile fixed.
  • Problem with cleared data inside a product window when it was docked to another place fixed.

Image mounting

  • Some logical UFED images were not working correctly: fixed.
  • Problems with invalid path symbols during processing of Mac OS X disk images fixed.
  • Not-terminated filenames in FAT file system fixed.


  • Performance problems during viewing of yEnc data fixed.
  • Passware decryption integration fixed.

Hundreds of smaller improvements and bugfixes made.


See also:

Belkasoft Evidence Center 7.1
Belkasoft Evidence Center 7.0
Belkasoft Evidence Center 6.3.1
Belkasoft Evidence Center 6.3
Belkasoft Evidence Center 6.2
Belkasoft Evidence Center 6.1
Belkasoft Evidence Center 6.0
Belkasoft Evidence Center 5.4
Belkasoft Evidence Center 5.3
Belkasoft Evidence Center 5.2
Belkasoft Evidence Center 5.1
Belkasoft Evidence Center 5.0
Belkasoft Evidence Center 4.2
Belkasoft Evidence Center 4.1
Belkasoft Evidence Center 4.0
Belkasoft Evidence Center 3.9
Belkasoft Evidence Center 3.8
Belkasoft Evidence Center 3.7
Belkasoft Evidence Center 3.6
Belkasoft Evidence Center 3.5
Belkasoft Evidence Center 3.0
Belkasoft Evidence Center 2.0